Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need help about configuration firewall ASA 5505 connected to 02 wan connections

interface Vlan1
 nameif inside
 security-level 100
 ip address 

interface Vlan2
 nameif outside
 security-level 0
 pppoe client vpdn group ******
 ip address pppoe setroute 

interface Vlan3
 description Link Wan  Router 2
 no forward interface Vlan2
 nameif outside2
 security-level 0
 ip address 

interface Ethernet0/0
 switchport access vlan 2            

interface Ethernet0/1
 switchport access vlan 3

object network obj_any
 nat (inside,outside) dynamic interface

route outside2 x.x.x.x 1
route outside2 y.y.y.y 1
route outside2 z.z.z.z 1

route (pppoe path)  // to internet

route inside a.a.a.a internal_gw_ip
route inside b.b.b.b internal_gw_ip
route inside c.c.c.c internal_gw_ip

access-list 101 extended permit ip host x.x.x.x any 
access-list 101 extended permit ip host y.y.y.y any 

access-group 101 in interface outside2

The internet works but no communication between (inside to outside2) or (outside2 to inside)

share|improve this question
What firmware version is on the ASA? – Epaphus Dec 27 '12 at 12:27
do you have address-space that is portable across providers? – Mike Pennington Dec 27 '12 at 15:18

ASAs can only use one WAN connection at a time (even in the latest 9.x firmware). You can configure WAN redundancy with sla monitors and the track argument to your default routes.

For example:

sla monitor 10
 type echo protocol ipIcmpEcho interface onecomm
sla monitor schedule 10 life forever start-time now
sla monitor 20
 type echo protocol ipIcmpEcho interface comcast
sla monitor schedule 20 life forever start-time now

route wan0 1 track 10
route wan1 2 track 20

Note 1: it's not necessary to put SLA monitors on both, but wanted to show it in case anyone seeing this has more than 2 connections, it's pretty easy to figure out how to configure the ASA for an arbitrary number of connections.
Note 2: The only harm in configuring as many monitors as you have WAN connections, if both connections go down there would be no default route, which is a problem if you use "far" monitoring targets. The example uses Google's DNS servers, which are not on the local links. If you used the DG of the link then the target is always local; this has the trade-off of a connection being considered "up" even if there are problems upstream of your connection...

TL;DR ASAs can not do load-balancing across multiple WAN connections. The only support redundancy. There are other devices available that can do load-balancing of course...

share|improve this answer

Have you got the matching nat statement for your outside2 link? you only have one in the config you posted. you would need this:

object network obj_any2
 nat (inside,outside2) dynamic interface

As long as you have the security plus licence you will be able to use routes to allow traffic to pass through both interfaces as you have configured.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.